Finding 2024-001: U.S. Department of Housing and Urban Development, Mortgage Insurance for the Purchase or Refinancing of Existing Multifamily Housing Projects (Section 223(f)/207) Statement of Condition: Internal control processes over financial reporting did not ensure that all transactions were properly recorded. Criteria: The HUD Handbook 4370.2, Chapter 2 requires the books and accounts to be complete and accurate. Additionally, 2 CFR Part 200 Section 200.302 Financial Management states that the financial management system of each non-federal entity must provide accurate, current, and complete disclosure of the financial results of each Federal award in accordance with the reporting requirements. Additionally, 2 CFR Part 200 Section 200.303(a), Internal Controls, requires that non-federal entities must establish and maintain effective internal controls over the federal award that provides reasonable assurance that the non-federal entity is managing the award in compliance with federal statutes, regulations and the terms and conditions. Effect: Noncompliance with HUD and Uniform Guidance regulations. Cause: Management oversight. Context: A review of journal entries made during the year revealed journal entries made in the incorrect period and erroneous journal entries. Additionally, the review process of the Corporation's financial information did not discover these errors. Recommendation: We recommend management review/enhance its accounting and internal control procedures to ensure that all key accounts are reconciled and reviewed with supporting evidence of such review. Questioned Costs: N/A Views of Responsible Officials and Corrective Action Plan: Management agrees with the finding and will review the accounting and financial procedures, system of internal controls and policies.
Assistance Listing Number: 10.728 Name of Federal Program: Inflation Reduction Act Hazardous Fuels Transportation Assistance Name of Federal Agency: Department of Agriculture Award Period: January 1, 2024 – December 31, 2024 Criteria or Specific Requirement: Per 2 CFR Part 200, non-federal entities receiving federal award must establish and maintain written policies and procedures addressing areas including, but not limited to, cash management (§200.302(b)(6)), allowability of costs (§200.302(b)(7)), procurement (§200.318-.326), compensation (§200.430(a)(1)), and fringe benefits (§200.431). Condition: ALC has not implemented all policies and procedures required by 2CFR Part 200, such as cash management, allowability of costs, procurement, compensation, and fringe benefits. Cause: ALC has not detailed its policies to conform with the requirements of the Uniform Guidance. Procurement policies and procedures have not been designed and implemented that adhere to Uniform Guidance requirements. Effect or Potential Effect: Without documented and implemented policies and procedures, ALC increases the risk of noncompliance with federal regulations, inconsistent application of requirements, unallowable costs being charged to federal awards, and potential questioned costs Context: Policies and procedures were inspected for compliance with the requirements of the Uniform Guidance. Repeat Finding: No Recommendation: ALC should develop, formally adopt, and implement all Uniform Guidance policies and procedures. Policies should be documented, communicated to relevant staff, and periodically reviewed to ensure ongoing compliance. Views of Responsible Officials: Management agrees with the finding and will implement procurement policies and procedures.
Section III – Major Federal Awards Programs – Findings and Questioned Costs Finding 2024-006: Activities Allowed or Unallowed / Allowable Costs - Inadequate Chart of Accounts Segregation for Unallowable Costs (Material Weakness) Federal Program : Grants for Transportation of Veterans in Highly Rural Areas Assistance Listing Number : 64.035 Criteria: Under 2 CFR 200.302(b)(3), non-Federal entities must maintain records that adequately identify the source and application of funds and must segregate unallowable costs to ensure compliance with cost principles. Condition: The chart of accounts does not sufficiently segregate unallowable costs from allowable program expenditures. Certain unallowable expenditures were coded to general operating accounts without clear differentiation. Cause: The Center lacks a detailed coding structure and written policies requiring explicit identification and segregation of unallowable costs. Effect: There is increased risk that unallowable costs could be charged to Federal awards, leading to potential noncompliance, questioned costs, or improper reimbursement requests. Recommendation: Management should implement a revised chart of accounts that clearly differentiates allowable vs. unallowable costs, supported by updated written policies and staff training. Repeat Finding: This is not a repeat finding.
Section III – Major Federal Awards Programs – Findings and Questioned Costs (Cont.) Finding 2024-007: Activities Allowed or Unallowed / Allowable Costs - Insufficient Budget-to-Actual Reviews (Material Weakness) Federal Program : Grants for Transportation of Veterans in Highly Rural Areas Assistance Listing Number : 64.035 Criteria: Under 2 CFR 200.302(b)(5) and established internal control frameworks such as COSO, entities must compare actual expenditures to budgeted amounts to ensure proper financial management and compliance with award terms. Condition: Budget-to-actual analyses were not consistently performed or documented for certain Federal programs. Cause: The Center lacks a formalized review schedule and adequate documentation procedures. Effect: Failure to identify variances may result in overspending, underspending, or misclassification of Federal program costs. Recommendation: Management should implement formal, periodic budget-to-actual reviews supported by standardized documentation requirements. Repeat Finding: This is not a repeat finding.
Section III – Major Federal Awards Programs – Findings and Questioned Costs (Cont.) Finding 2024-011: Reporting - Insufficient Policies to Ensure Completeness and Accuracy of Reports (Material Weakness) Federal Program : Grants for Transportation of Veterans in Highly Rural Areas Assistance Listing Number : 64.035 Criteria: Under 2 CFR 200.328 and 200.302(b)(2), entities must maintain internal controls to ensure that financial and performance reports are accurate, complete, and supported by appropriate documentation. Condition: Reports submitted for Federal awards were not consistently reviewed for accuracy, and review procedures were not documented. Cause: The Center lacks a formal reporting policy and does not have a documented review process in place. Effect: There is an increased risk of inaccurate reporting to Federal awarding agencies, which may impact funding decisions and compliance status. Recommendation: Management should establish a formal reporting policy requiring documented supervisory reviews prior to the submission of financial and performance reports. Repeat Finding: This is not a repeat finding.
2 CFR § 200.302(b)(7) requires written procedures for determining the allowability of costs in accordance with Subpart E-Cost Principles of this part and the terms and conditions of the Federal award. 2 CFR 200.320(b)(2) requires non-federal entities to have a written method for conducting technical evaluations of the competitive proposals receive and for selecting contract recipients. 2 CFR 200.319(d) requires non-federal entities to have written procedures for procurement transactions to ensure all solicitations incorporate a clear and accurate description of the technical requirements for the material, product, or service to be procured and identify all requirements which the offerors must fulfill and all other factors to be used in evaluating bids or proposals. The Village was awarded grant monies under the Uniform Guidance (UG); however, the Village did not establish formal written policies required by the UG for the sections listed above. To help ensure compliance with the Uniform Guidance requirements, the Village should establish and maintain timely updated policies and, more importantly, implement procedure as specified by UG requirements for all grant monies received. Any changes to the Village's policies should also be formally approved by Council and documented within the minutes.
Finding 2024-003: 93.591 - U.S. Department of Health and Human Services - Family Violence Prevention and Services/State Domestic Violence Coalitions Allowable Costs/Cost Principles, Significant Deficiency in Internal Control and Noncompliance Criteria: According to 2 CFR § 200.302(b)(5), non-federal entities must have written procedures to ensure that expenditures are in accordance with the terms and conditions of the federal award. Furthermore, entities are expected to compare actual expenditures with budgeted amounts for each federal award. Condition: During our audit, we noted that the Organization does not maintain or regularly review a budget-to-actual comparison for expenditures charged to the federal grant. As a result, management is unable to assess whether spending is aligned with the approved grant budget. Effect: Failure to monitor expenditures against the approved grant budget increases the risk of unallowable costs, budget overruns, and noncompliance with grant terms, which may result in questioned costs or potential repayment of funds. Questioned Costs: None. Cause: The Organization has not established internal procedures or systems to monitor grant expenditures against the approved budget. _x000C_Recommendation: We recommend that the Organization implement a process to compare actual expenditures to the approved grant budget on a regular basis. This may include monthly or quarterly reviews by program and finance staff to ensure expenditures remain within approved categories and thresholds. Documentation of such reviews should be maintained to demonstrate compliance.
Finding 2024-004: 93.591 - U.S. Department of Health and Human Services - Family Violence Prevention and Services/State Domestic Violence Coalitions Allowable Costs/Cost Principles, Material Weakness in Internal Control and Noncompliance Criteria: In accordance with 2 CFR §200.403(g), costs must be adequately documented in order to be allowable under a federal award. Additionally, per 2 CFR §200.302(b)(3), recipients must maintain records that identify the source and application of funds for federally funded activities. Furthermore, effective internal controls per 2 CFR §200.303 require that transactions be properly authorized and reviewed to ensure compliance with applicable requirements. Condition: During our testing of expenses charged to the federal award, we reviewed a sample of 10 transactions totaling $9,284. Of those, 7 transactions (representing $8,980) were found to be noncompliant due to one or both of the following: • Missing supporting documentation, such as receipts or invoices • Missing approval documentation, such as required supervisor sign-offs These issues impaired our ability to determine whether the expenses were allowed, reasonable, and allocable under the terms of the award. Due to the high rate of errors, we performed extrapolation procedures over the population of similar expenses totaling $107,782. Based on the sample error rate and our extrapolation methodology, we estimate that $36,846 of the total expenses charged to the federal award may be unallowable and are thus considered extrapolated questioned costs. Effect: As a result of insufficient supporting and approval documentation, the allowability of a significant portion of expenses charged to the federal award could not be determined. This has led to an extrapolated questioned cost of $36,846. Questioned Costs: $36,846 (extrapolated) Cause: The deficiencies noted appear to be the result of weak internal controls related to documentation and approval workflows for federal expenditures. Specifically, the Organization does not appear to have a consistent process to: • Ensure documentation is retained for all expenses • Verify and record supervisory or grant-related approvals Recommendation: We recommend the Organization take immediate steps to improve internal controls related to documentation and record retention for federal program expenditures. The Organization should ensure that all expenses charged to the federal award are supported with adequate documentation. Additionally, the Organization should also ensure approvals are properly documented regardless if the expense is paid by check or electronic payment.
2024-005 – Insufficient Financial Management Condition: The Organization drew down more revenues than expenditures incurred. Criteria: The VA Staff Sergeant Parker Gordon Fox Suicide Prevention Grant Program regulations (38 CFR Part 78) and the Uniform Guidance (2 CFR 200.302) require grantees to maintain a financial management system that provides accurate, current, and complete financial information, effective control over federal funds, and adequate documentation supporting all costs charged to the program. Financial management is considered insufficient when accounting practices do not ensure timely, accurate, and supported reporting of expenditures and drawdowns. Effect: Failure to maintain accurate financial data will result in discrepancies between expenditures and draw-downs. It also increases the risk of inaccurate financial results provided at closeout or unauthorized or ineligible expenses charged to the award, which may result in funding shortages for other qualified expenses. Cause: Homeward Bound Adirondack, Inc. failed to provide adequate oversight and internal controls to ensure the maintenance of accurate financial records. Specifically, credit card charges were recorded in the general ledger based on the day the charges cleared rather than the date the costs were incurred. This practice resulted in delays in recording expenditures, causing them to be recorded in the incorrect period. Recommendation: We recommend that Homeward Bound Adirondack, Inc. establish oversight practices to ensure that all revenues and expenses are recorded appropriately and reconciled to the proper drawdown requests. Response: Homeward Bound Adirondack, Inc. agrees with the finding and will implement procedures to address the recommendation in 2025.
Finding 2024-005 – Period of Performance Federal Agency: U.S. Department of Treasury Federal Program: Coronavirus State and Local Fiscal Recovery Funds AL Number: 21.027 Pass-through: Community Shelter Board Award Number: YMCA-24-CSB and YMCA-25-CSB Award Year: 7/1/2023 – 6/30/2024 and 7/1/2024 – 6/30/2025 Type of Finding: Material Weakness and Noncompliance Criteria: 2 CFR 200.403(h): Administrative closeout costs may be incurred until the due date of the final report(s). If incurred, these costs must be liquidated prior to the due date of the final report(s) and charged to the final budget period of the award unless otherwise specified by the Federal agency. All other costs must be incurred during the approved budget period. 2 CFR 200.302: The recipient's and subrecipient's financial management system must provide for the following: Maintaining records that sufficiently identify the amount, source, and expenditure of Federal funds for Federal awards. These records must contain information necessary to identify Federal awards, authorizations, financial obligations, unobligated balances, as well as assets, expenditures, income, and interest. All records must be supported by source documentation. Condition: The Association was unable to verify whether costs recorded in the financial accounting system were included in invoices submitted for cost reimbursement. As such, auditors could not verify whether these costs were included in the appropriate period of performance. Context: Out of a sample of 40 transactions tested for compliance with period of performance requirements, 27 of them could not be traced to a reimbursement invoice. Most of these transactions were transfers of payroll costs from one program to another. Cause: The Association did not have a strong process to track program expenses with the financial accounting system and did not effectively reconcile expenditures between the general ledger and the Schedule of Expenditures of Federal Awards. In addition, the Association did not maintain support for expenditures charged to federal grants to be able to support whether they were within the allowable period of performance. Effect: The Association could not provide evidence of whether the transactions tested were within the period of performance. Questioned costs: $602,142 Identification of how questioned costs were computed: Known questioned costs were computed by summing the dollar amount of selections that were identified as errors which totaled $6,829. An error rate was calculated by taking the number of errors divided by the total sample size as described in the Context section. This error rate was then applied to the untested population to calculate projected questioned costs of $595,313. Repeat finding: Not applicable. Recommendation: The Association should review its policies and procedures to ensure costs recorded in the financial accounting system are able to be reconciled to invoices submitted for cost reimbursement as well as the Schedule of Expenditures of Federal Awards. Views of responsible officials: See Corrective Action Plan.
2 CFR § 300 codified in 45 CFR part 75 gives regulatory effect to the Department of Health and Human Services. 2 CFR § 200.302(b)(6) states the financial management system of each non-Federal entity must provide for written procedures to implement the requirements of 2 CFR § 200.305 Payment. Additionally, for Federal awards, the Uniform Guidance requires a written policy for the procurement requirements outlined in 2 CFR § 200.318(c)(1), 2 CFR § 200.318(c)(2), and 2 CFR § 200.320(B) 2 CFR 200.302(b)(7) requires written procedures for determining the allowability of costs in accordance with Subpart E-Cost Principles of this part and the terms and conditions of the Federal award. 2 CFR 200.430 states that costs of compensation are allowable to the extent that they satisfy the specific requirements of this part, and that the total compensation for individual employees: (1) Is reasonable for the services rendered and conforms to the established written policy of the non-Federal entity consistently applied to both Federal and non-Federal activities; (2) Follows an appointment made in accordance with a non-Federal entity's laws and/or rules or written policies and meets the requirements of Federal statute, where applicable; and (3) Is determined and supported as provided in paragraph (i) of this section, Standards for Documentation of Personnel Expenses, when applicable. 2 CFR 200.431 requires established written leave policies if the entity intends to pay fringe benefits. 2 CFR 200.464(a)(2) requires reimbursement of relocation costs to employees be in accordance with an established written policy must be consistently followed by the employer. 2 CFR 200.475 requires reimbursement and/or charges to be consistent with those normally allowed in like circumstances in the non-Federal entity's non-federally-funded activities and in accordance with non-Federal entity's written travel reimbursement policies. The General Health District did not have written policies as required by Uniform Guidance. The failure to implement written policies as required by Uniform Guidance could result in noncompliance with the District’s federal programs. The General Health District should adopt written policies in accordance with the Uniform Guidance.
Internal Control over Compliance and Compliance with Reporting (Preparation of the Schedule of Expenditures of Federal Awards (SEFA)) ALN: 10.904, Milk River Project ALN: 10.923, Stream Restoration and Bridge Replacement for St. Mary Siphon Failure ALN: 15.U01, Replacement of St. Mary and Hallls Coulee Siphons on St. Mary Canal CRITERIA: The Code of Federal Regulations (CFR) Section §200.510(b) states in part: "The auditee must also prepare a schedule of expenditures of Federal awards for the period covered by the auditee's financial statements which must include the total Federal awards expended as determined in accordance with CFR Section §200.502 Basis for determining Federal awards expended." The schedule must provide total Federal awards expended for each individual Federal program. CFR 200.302(b)(1) requires that the nonfederal entity must identify in its accounts and on the schedule of expenditures of federal awards all federal awards received and expended, as well as the federal programs under which they were received. Federal program and award identification must include, as applicable, the Assistance Listing program title and number, the federal award identification number and year, the name of the federal agency, and the name of the pass-through entity, if any. CONDITION: The ALN 10.923, Stream Restoration and Bridge Replacement for St. Mary Siphon Failure, was left off the prepared SEFA. Amounts reported for ALN 10.904 and ALN 15.U01 did not agree to the accounting records. CONTEXT: The SEFA was misstated as follows: • Understated for ALN 10.904 by $196,980; • Understated for ALN 10.923 by $105,977; and • Overstated for ALN 15.U01 by $1,978,224. The net effect was an overstatement of $1,675,267 for total federal expenditures. EFFECT: The SEFA provided was not complete and accurate. QUESTIONED COSTS: None CAUSE: The internal controls for the preparation of the SEFA and review of the SEFA were not present to ensure the SEFA was complete and accurate. RECOMMENDATION: We recommend the MRJBOC prepare written procedures on how to put together the SEFA and strengthen internal controls to ensure all federal awards are included on the SEFA. We also recommend that the SEFA be reviewed by someone other than the preparer for completeness and accuracy prior to providing to the auditor. MRJBOC RESPONSE: MRJBOC acknowledges the deficiencies identified in the preparation and review of the Schedule of Expenditures of Federal Awards (SEFA). During 2024, the organization experienced a significant increase in federal funding activity related to emergency response and infrastructure replacement projects. The rapid expansion of federal programs, addition of funds and reporting requirements exceeded existing internal documentation and review processes. To strengthen compliance controls and ensure SEFA accuracy in future reporting periods, MRJBOC will implement the following corrective actions: • Develop and formalize written SEFA preparation procedures, including grant identification, ALN verification, and reconciliation to general ledger balances. • Establish a dual-review process in which the SEFA is reviewed and approved by a party independent from the preparer prior to submission to auditors. • Maintain a centralized federal grant tracking log that includes award numbers, funding sources, drawdowns, and cumulative expenditures. These measures will improve internal control over federal reporting, enhance accuracy, and ensure compliance with federal audit requirements.
Criteria: 2 CFR Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, Subpart D – Post Federal Awards Requirements, Standards for Financial and Program Management, and §200.302 (b), Financial Management. The recipients financial management system must provide for identification, in its accounts, of all federal awards received and expended and the federal program under which they were received. Federal program and federal award identification must include, as applicable, the federal assistance listing title and number, federal award identification number, name of the federal agency, and name of the pass-through entity, if any. Additional Criteria: 2 CFR Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, Subpart F – Audit Requirements, §200.510, Financial Statements. Schedule of Expenditures of Federal Awards – The auditee also must prepare a schedule of expenditures of federal awards for the period covered by the auditee’s financial statements, which must include the total federal awards expended, as determined in accordance with §200.502, Basis for Determining Federal Awards Expended. At a minimum, the schedule must provide total federal awards expended for each individual federal program and the federal assistance listing number or other identifying number when the federal assistance listing information is not available. For a cluster of programs, also provide the total for the cluster. Condition: PCRI did not maintain a complete schedule of expenditures of federal awards. Cause: PCRI did not adequately track which government grants were federally-funded, resulting in an incomplete schedule of expenditures of federal awards. Effect: Failure to prepare an accurate and complete schedule of expenditures of federal awards results in noncompliance with 2 CFR Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, Subpart D – Post Federal Awards Requirements, Standards for Financial and Program Management, §200.302, Financial Management, and Subpart F – Audit Requirements, §200.510, Financial Statements. Recommendation: We recommend that PCRI document and implement policies and procedures to ensure the schedule of expenditures of federal awards is accurate and complete in accordance with 2 CFR Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, Subpart D – Post Federal Awards Requirements, Standards for Financial and Program Management, §200.302, Financial Management, and Subpart F – Audit Requirements, §200.510, Financial Statements, in order to obtain accurate calculations of major federal programs for the Single Audit and to ensure that PCRI is in compliance with all of the reporting requirements as to identify the source and application of funds for federally-funded activities.
Lack of Written Procedures for Determining Allowability of Costs Condition: The Agency did not maintain written procedures for determining the allowability of costs charged to federal awards. Although management performs reviews of expenses to ensure reasonableness, these reviews are not guided by documented policies or standardized criteria. Criteria: In accordance with 2 CFR 200.302(b)(7), non-federal entities must maintain written procedures for determining allowability of costs in accordance with Subpart E - Cost Principles of the Uniform Administrative Requirements, Costs Principles, and Audit Requirements for Federal Awards ("Uniform Guidance"). Cause: Management was unaware that Uniform Guidance requires written procedures specifically addressing cost allowability, separate from general internal control or purchasing policies. Effect: Without documented procedures, there is an increased risk that unallowable or unsupported costs may be charged to federal programs, potentially resulting in noncompliance with federal cost principles and repayment obligations. Questioned Cost: None noted as a result of audit procedures performed. Recommendation: Management should develop and implement written procedures for determining allowability of costs consistent with the requirements of 2 CFR 200.302(b)(7). Procedures should clearly define responsibilities, documentation requirements, and approval processes to ensure all cost charged to federal programs are allowable, allocable, and reasonable. Management Response: We agree with the findings in the audit report and have developed a Corrective Action Plan to address each item promptly. This has been a challenging year for the organization, including turnover in the Chief Financial Officer ("CFO") position and the fact that this was our first Single Audit due to increased federal funding related to COVID-19 programs. These factors contributed to delays in audit readiness, gaps in technical accounting for grants, and weaknesses in internal controls over financial reporting and federal award reporting. We have implemented a comprehensive plan to address these challenges and will be hiring a new CFO in the first quarter of 2026.
Finding Reference Number: 2024-002 Reportable finding considered a significant deficiency - Inadequate support for distribution of donated food Title and CFDA Number of Federal Program: Emergency Food Assistance Program: 10.568 & 10.569 Federal award numbers & periods: 22-MOU-00108 23/24. 10/1/2023 - 9/30/2024 22-MOU-00108 24/25. 10/1/2024 - 9/30/2025 Type of Finding: Financial Statement and Federal Award Finding Finding Resolution Status: In Process Identification of Repeat Finding and Finding Reference Number: This is not a repeat finding Criteria: Organizations are required to maintain adequate documentation and an audit trail for all food distributions, including goods sent to distribution sites and goods used for on-site meal preparation, in accordance with sound internal control practices and applicable grant requirements (e.g., Uniform Guidance 2 CFR §200.302 – Financial Management and §200.303 – Internal Controls). Statement of Condition: During the audit, Food Bank Distribution Reports were provided showing goods sent to three locations, including recipient sign-offs, stating they received the food. Each location tracks food received and distributed to individuals. Leftover food is sent to various nonprofits to assist with distribution, if any. However, documentation for goods that were received and not distributed, at these three locations, could not be produced for review as an audit trail for who received and distributed leftover food. Additionally, Congregate Aggregate Feeding Reports, which track goods used for on-site meal preparation, and subsequent distribution, were also not available for review as they were not kept on file. The Organization lacked distribution documentation to support their monthly Distribution Report for goods distributed resulting in an incomplete audit trail. Cause: The Organization did not have formalized procedures or controls to ensure that all food distributions and on-site meal preparation activities were consistently documented and retained. Tracking was handled internally without standardized reporting requirements, resulting in incomplete records. Effect or Potential Effect: The absence of complete supporting documentation limits the Organization’s ability to demonstrate compliance with internal policies and donor requirements. It increases the risk of misstatement, misappropriation of goods, and potential noncompliance with grant or regulatory requirements. Questioned Costs: There are no questioned costs associated with this finding. Context: During our testing of food distribution documentation, we selected Food Bank Distribution Reports from three distribution locations for the audit period. For each location, we reviewed documentation supporting goods received, goods distributed, and any goods remaining at the end of the distribution cycle. While signed recipient logs were available to support goods initially received at the locations, supporting documentation for goods that were received but not distributed—including records identifying where leftover food was subsequently sent—was not available for any of the three locations reviewed. Additionally, for onsite meal preparation activities, we requested Congregate Aggregate Feeding Reports used to track the quantities of goods prepared and served; however, the Organization did not retain these reports for the period under audit. As a result, none of the sampled items related to meal preparation activities had supporting documentation available for review. Recommendation: We recommend that management implement and enforce policies to ensure that all food distributions, including on-site meal preparation and any goods not distributed separately, are properly tracked and supported by documentation. This should include maintaining Congregate Aggregate Feeding Reports, retaining all distribution records and reconciling them to the Monthly Distribution Report, establishing procedures to ensure discarded goods are documented appropriately. These steps will strengthen internal controls and provide a clear audit trail for all commodities. Auditors’ Summary of the Auditee’s Comments on the Findings and Recommendations: See Corrective Action Plan
2 CFR 1000.10 provides that, except for the deviations set forth elsewhere in this Part, the Department of Treasury adopts the Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards set forth at 2 CFR Part 200. 2 CFR 200.302 states, in part, the financial management system of each non-Federal entity must provide for accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in §§ 200.328 and 200.329. 2 CFR 200.329(c)(1) states that non-Federal entities must submit performance reports at the interval required by the Federal awarding agency or pass-through entity to best inform improvements in program outcomes and productivity. Reports submitted quarterly must be due no later than 30 calendar days after the reporting period. 31 CFR 35.4(c) requires recipients, in part, during the period of performance, to provide the Secretary of the U.S. Department of Treasury periodic reports providing detailed accounting of the uses of funds, modifications to a State or Territory's tax revenue sources, and such other information as the Secretary may require for the administration of this section. The U.S. Department of Treasury provided supplementary information in its 2021 interim final rule on reporting requirements for State and Local Fiscal Recovery Funds for 31 CFR Part 35 and provided further guidance in its Project and Expenditure Report User Guide for State and Local Fiscal Recovery Funds. The 2021 interim rule supplementary information, part VIII states that counties will be required to submit quarterly Project and Expenditure reports through the end of the award period on December 31, 2026. The Department of Treasury’s Project and Expenditure Report User Guide provides, in part, that counties with a population that exceeds 250,000 residents must submit a Project and Expenditure Report by January 31, 2022 and then the last day of the month after the end of each quarter thereafter. The County did not have proper internal controls in place to ensure the timely and accurate submission of the Project and Expenditure Reports. During testing of Project and Expenditure Reports for the COVID-19 Coronavirus State and Local Fiscal Recovery Funds (AL #21.027), we noted that: • The County did not submit the Project and Expenditure Reports for the second and fourth quarters by the required deadlines of July 31, 2024 and January 31, 2025, respectively. • On the first quarter Project and Expenditure Report, the County understated current period expenditures by $1,041,688, understated cumulative expenditures by $11,564,350, and understated cumulative obligations by $1,407,879. Similarly, on the third quarter Project and Expenditure Report, the County understated current period expenditures by $385.732, understated the cumulative expenditures by $13,169,950, and understated cumulative obligations by $1,407,879. Failure to have the proper controls in place to ensure the timely and accurate submission of the Project and Expenditure Reports could result in Treasury taking action against the County for failure to comply with programmatic requirements. The County should implement and have controls in place to ensure the quarterly Project and Expenditure Reports are accurate and filed by the required due dates.
ALN 14.251 and ALN 21.027 Finding #2024‐004 Incorrect Recording of Expenditures that were Notes Receivable Draws Repeat Finding: No Condition: The Organization recorded $2,425,133 of federal program expenditures as expenses in the year ended December 31, 2024. These amounts represented disbursements made to a subrecipient under terms that required repayment, and therefore should have been recorded as a note receivable. The Organization did not recognize the note receivable nor properly classify the related transactions, resulting in a misstatement of expenditures and assets. Criteria: In accordance with 2 CFR 200.302 and generally accepted accounting principles (GAAP), the Organization is required to maintain accurate, current, and complete disclosure of financial results of each federal award. Accounting records must adequately identify the source and application of federal funds and properly classify transactions, assets, liabilities, and equity in accordance with GAAP. Cause: The misclassification occurred because the Organization did not have sufficient internal controls to ensure that disbursements under this program were evaluated for the proper accounting treatment (i.e., expense versus note receivable/loan). Effect: Federal program expenditures were overstated by $2,245,133 and assets were understated by the same amount. The lack of proper classification may affect stakeholders’ understanding of the Organization’s financial position and federal compliance. Questioned Costs: None noted, as the expenditures were incurred under the program; however, the classification error represents a material reporting misstatement. Perspective Information: The condition noted represents $2,425,133 of expenditures, which were inaccurately reported. Recommendation: We recommend that the Organization strengthen its review process over accounting for federal program disbursements. Policies and procedures should require evaluation of whether disbursements meet the definition of an expense or a loan/note receivable in accordance with GAAP and federal reporting requirements. Reporting Views of Responsible Officials: The Organization agrees with the finding. The Organization’s accountant was unaware that the federal grant payments to the subrecipient were considered draws on a note receivable. Corrections have been made to improve communication with the accountant to ensure the accountant is aware of key grant provisions and to ensure note receivable draws are being properly accounted for in the general ledger.
ALN 21.027 Finding #2024‐005 Insufficient Accounting to Track Federal Grant Expenditures Repeat Finding: No Condition: The Organization did not maintain accounting records that sufficiently tracked expenditures relating to the federal program. Instead, federal program expenditures were co‐mingled with all other organizational expenditures. As a result, the Organization was unable to readily identify the federal share of costs or demonstrate that the costs charged were allowable under the terms of the award. Criteria: Per 2 CFR 200.302, non‐federal entities must maintain financial management systems that provide for: · Accurate, current, and complete disclosure of financial results of each federal award; · Records that identify adequately the source and application of federal funds; and · Effective control and accountability for all funds, property, and other assets. These requirements include maintaining accounting records that segregate federal program expenditures from non‐federal activity to ensure compliance with applicable statutes, regulations, and terms of the award. Cause: The Organization did not implement accounting controls and procedures to establish separate accounts or cost centers for federal program expenditures. Effect: Because federal program expenditures were not separately tracked, there is an increased risk of: · Unallowable or unsupported costs being charged to the program, · Inaccurate reporting on the Schedule of Expenditures of Federal Awards (SEFA), and · Noncompliance with Uniform Guidance financial management standards. Questioned Costs: None noted. Perspective Information: The condition affected one of the Coronavirus State and Fiscal Recovery – ARPA grants, ALN 21.027, which accounted for $153,653 of federal expenditures for 2024. Recommendation: We recommend that the Organization implement an accounting system that separately tracks federal program expenditures, either through distinct general ledger accounts, cost centers, or project codes. The system should allow management to readily identify federal expenditures, prepare accurate SEFA reporting, and demonstrate compliance with federal requirements. Reporting Views of Responsible Officials: The Organization agrees with the finding. The Organization is in process of implementing a project‐based ledger and procedures to ensure federal expenditures are properly coded so they are readily identifiable.
ALN 14.251 and ALN 21.027 Finding #2024‐006 Financial Policies and Procedures Repeat Finding: No Condition: The Organization did not have formalized, written financial policies and procedures that address key Uniform Guidance requirements. Criteria: Under 2 CFR 200.302(b), non‐federal entities must establish and maintain effective financial management systems that provide accurate, current, and complete disclosure of the financial results of each federal award. Uniform Guidance further requires that entities implement written policies and procedures governing: · Allowable costs (2 CFR 200.302(b)(7) and 200.403–200.405), · Procurement (2 CFR 200.317–200.327), · Cash management (2 CFR 200.305), · Travel costs (2 CFR 200.475), and · Conflict of interest (2 CFR 200.318(c)(1)). Written policies serve as the framework for consistent compliance with federal requirements. Cause: The Organization had not developed or adopted written financial policies, relying instead on informal practices and staff knowledge to manage federal awards. Effect: The absence of formalized financial policies increases the risk of noncompliance with Uniform Guidance, inconsistent application of requirements, and potential misuse of federal funds. The lack of a documented framework also limits accountability and makes it difficult to train new staff or demonstrate compliance to oversight agencies. Questioned Costs: None noted. Perspective Information: This condition applied to the Organization’s overall financial management system and impacted all federal programs administered during the year ended December 31, 2024. As such, the lack of formalized financial policies represents a systemic issue and a material weakness in internal control over compliance. Recommendation: We recommend that the Organization adopt formal, written financial policies and procedures that address all Uniform Guidance requirements applicable to federal awards. These policies should be approved by management and the governing body, disseminated to staff, and reviewed periodically to ensure continued compliance. Reporting Views of Responsible Officials: The Organization agrees with the finding. The Organization will establish formalized accounting policies and procedures that adhere to the requirements of the Uniform Guidance.
Finding 2024-005 - Reporting Federal Award Information: Federal Agency: U.S. Department of Health and Human Services Pass-Through Entity: Texas Department of Housing and Community Affairs Assistance Listing Number (ALN): 93.568 Federal Program Name: Low-Income Home Energy Assistance Type of Finding: Material Weakness in Internal Control Over Compliance Reporting Compliance Requirement No Questioned Costs Criteria: Under 2 CFR 200.303, the Organization is required to establish and maintain effective internal control over Federal awards that provides reasonable assurance of compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Additionally, 2 CFR 200.302(a) requires that the financial management system provide accurate, current, and complete disclosure of the financial results of each Federal award. Further, 2 CFR 200.334 requires financial records, supporting documents, statistical records, and all other records pertinent to a Federal award be retained to support amounts reported. The OMB Compliance Supplement identifies Reporting as a compliance requirement for this program and requires that financial reports be supported by underlying accounting records and subject to appropriate review prior to submission. Condition: During our audit, we noted that financial reports submitted to the Federal awarding agency were not consistently supported by retained documentation demonstrating how reported amounts were calculated. In addition, there was no documented evidence of supervisory review or approval of the reports prior to submission. During interim testing of reports, we noted that certain periodic financial reports submitted to the pass-through entity did not reconcile to the Organization’s general ledger at the time of submission. The variances were attributable to journal entries, voided checks, and other posting adjustments recorded after report submission. While cumulative and final reports ultimately agreed to the Organization’s accounting records and no amended reports were required, documentation reconciling the differences at the time of submission was not retained. documentation was retained for amounts reported to the Federal awarding agency or to require documented supervisory review of reports prior to submission. Effect or Potential Effect: The absence of supporting documentation and independent review increases the risk that inaccurate, incomplete, or unsupported information could be reported to the Federal awarding agency and not be detected in a timely manner. Although no questioned costs were identified as a result of our audit procedures, this deficiency creates a reasonable possibility that material noncompliance with reporting requirements could occur and not be prevented or detected on a timely basis. Questioned Costs: None. Repeat Finding: This is not a repeat finding. Recommendation: We recommend that management implement procedures to: Retain supporting documentation for all amounts reported to Federal awarding agencies, including reconciliations to the general ledger; Require documented supervisory review and approval of reports prior to submission; and Ensure that adjustments occurring after report submission are documented and, when necessary, corrected through revised reporting. Views of Responsible Officials and Planned Corrective Action: Management acknowledged that supporting documentation was not consistently retained and that supervisory review was not formally documented. Management has indicated that procedures will be implemented to ensure reports are reconciled to accounting records, properly supported, and reviewed prior to submission.
Finding 2024-001 - U.S. Department of Housing and Urban Development, Mortgage Insurance Rental and Cooperative Housing for Moderate Income Families and Elderly, Market Interest Rate, CFDA #14.135 Statement of Condition: Internal control processes over financial accounting did not ensure that all transactions were properly recorded. Internal control processes over financial accounting did not ensure that key accounts were reconciled or reviewed on a periodic basis. Criteria: The HUD Handbook 4370.2 REV-1, Chapter 2 requires the books and accounts to be complete and accurate. HUD Handbook 4370.2 REV-1, Chapter 2, Section 12 requires monthly reconciliations of all cash accounts. Additionally, 2 CFR Part 200 Section 200.302 Financial Management states that the financial management system of each non-federal entity must provide accurate, current, and complete disclosure of the financial results of each Federal award in accordance with the reporting requirements. Additionally, 2 CFR Part 200 Section 200.303(a), Internal Controls, requires that non-federal entities must establish and maintain effective internal controls over the federal award that provides reasonable assurance that the non-federal entity is managing the award in compliance with federal statutes, regulations and the terms and conditions. Effect: Noncompliance with HUD and Uniform Guidance requirements and the possibility of undetected material misstatements and/or undetected misappropriation of assets. Cause: Prior management oversight. Context: An understanding of processes and internal controls was performed with the Corporation's management and tests were performed to determine if the processes and internal controls were implemented and effective. As part of this process we noted the following processes and internal controls were not effective and/or implemented. 1) Only two of the six bank accounts were reconciled. The outsourced bookkeeper only performed a bank reconciliation for the operating and security deposit cash accounts. 2) The accounts receivable, tenants and accounts receivable, HUD were not reconciled. 3) The monthly review process of the Corporation's financial information is not fully supported by evidence of such review. Questioned Costs: N/A Recommendation: We recommend management review/enhance its accounting and internal control procedures to ensure that all key accounts are reconciled and reviewed with supporting evidence of such review. Views of Responsible Officials and Corrective Action Plan: Management agrees with the finding and will review the accounting and financial procedures, system of internal controls and policies. The Corporation has executed a new management agreement with Remnant Management Inc. effective October 1, 2024. Remnant Management Inc. will ensure that all transactions are properly recorded and that key accounts are reconciled and reviewed on a periodic basis beginning October 1, 2024 and going forward.
Subject: Section 8 Housing Choice Voucher Program Federal Agency: Department of Housing and Urban Development Federal Program: Section 8 Housing Choice Vouchers Assistance Listing Number: 14.871 Federal Award Number and Year (or Other Identifying Number): CY 2024 Pass-Through Entity: Not applicable Compliance Requirement: Allowable Costs Audit Finding: Significant Deficiency Condition and Context: During the review of disbursements, it was noted the Housing Authority does not consistently document approval of disbursements prior to payment. Our sample of cash disbursements revealed that checks and electronic payments were processed without evidence of review or authorization by management. Criteria: Per 2 CFR §200.302(b)(3), non-Federal entities must maintain effective internal control over Federal awards that provides reasonable assurance that charges to Federal programs are allowable, allocable, and in compliance with laws, regulations, and the provisions of contracts or grant agreements. Additionally, sound internal control practices require that disbursements be reviewed and approved to ensure they are valid, properly supported, and in compliance with program requirements. Cause: The Authority has not implemented procedures requiring documented review and approval of disbursements before payment is made. Effect: Without documented approval of disbursements, there is an increased risk of unauthorized, unsupported, or unallowable expenditures. Questioned Cost: Known and projected misstatement: None Recommendation: The Housing Authority should implement policies and procedures that require all disbursements to be approved by the Board prior to checks being issued.
2024-005 Internal Controls over Grant Management (Significant Deficiency and Noncompliance) (repeat finding 2023-005) Criteria: 2 CFR 200.302 establishes the requirements of a financial management system adequate to ensure compliance with federal regulations. This system must include written procedures to implement requirements for payment methods and determine the allowability of costs in accordance with subpart E. Statement of Condition: The City has written fiscal policies but they do not meet the financial management system requirements established in the regulations. Cause: The City has processes and procedures in place to administer grant funds but written policies do not contain compliance requirements. Effect: The City is not in compliance with financial management system requirements. Recommendation: The City should develop a grants manual or additional written policies to incorporate all the requirements of 2 CFR 200 and ensure compliance. Views of Management and Planned Corrective Action: See Corrective Action Plan included at the end of the report.
Finding 2024-005 Allowable Costs–Payroll Costs (Significant Deficiency and Noncompliance) (Repeat Finding) Information on the Federal Program: U.S. Department of Health and Human Services, Assistance Listing #93.243 Substance Abuse and Mental Health Services Projects of Regional and National Significance. Criteria: 2 CFR section 200.302 establishes the requirements for sufficient financial management over grant funding to ensure records adequately identify the source and application of funds for federally funded activities. These records must contain information pertaining to Federal awards, authorizations, financial obligations, unobligated balances, assets, expenditures, income and interest and be supported by source documentation. Condition: We tested 32 payroll disbursements across five pay periods. Of those 32, 5 exceptions were noted. One exception was that the amount of time and corresponding amounts allocated to the grant did not agree to the percentage documented on the employee’s timesheet. For the other 4 exceptions, the supporting time sheets could not be provided for a pay period tested. Cause: Employee timesheets are turned in after payroll is processed and allocations made, the timesheet in this exception did not agree to the amount allocated. Four supporting time sheets for a January payroll processed could not be located. Effect: The Council did not retain proper documentation to support payroll costs charged to the grant. Questioned Costs: $729 Recommendation: We recommend the Council strengthen procedures surrounding payroll so that the source documentation agrees to and is retained to support the amounts being allocated to the grant based on actual employee time. Views of Responsible Officials: See Management’s View and Corrective Action Plan at the end of the report.
Finding 2024-005 Allowable Costs–Payroll Costs (Significant Deficiency and Noncompliance) (Repeat Finding) Information on the Federal Program: U.S. Department of Health and Human Services, Assistance Listing #93.243 Substance Abuse and Mental Health Services Projects of Regional and National Significance. Criteria: 2 CFR section 200.302 establishes the requirements for sufficient financial management over grant funding to ensure records adequately identify the source and application of funds for federally funded activities. These records must contain information pertaining to Federal awards, authorizations, financial obligations, unobligated balances, assets, expenditures, income and interest and be supported by source documentation. Condition: We tested 32 payroll disbursements across five pay periods. Of those 32, 5 exceptions were noted. One exception was that the amount of time and corresponding amounts allocated to the grant did not agree to the percentage documented on the employee’s timesheet. For the other 4 exceptions, the supporting time sheets could not be provided for a pay period tested. Cause: Employee timesheets are turned in after payroll is processed and allocations made, the timesheet in this exception did not agree to the amount allocated. Four supporting time sheets for a January payroll processed could not be located. Effect: The Council did not retain proper documentation to support payroll costs charged to the grant. Questioned Costs: $729 Recommendation: We recommend the Council strengthen procedures surrounding payroll so that the source documentation agrees to and is retained to support the amounts being allocated to the grant based on actual employee time. Views of Responsible Officials: See Management’s View and Corrective Action Plan at the end of the report.
Finding 2024-005 Allowable Costs–Payroll Costs (Significant Deficiency and Noncompliance) (Repeat Finding) Information on the Federal Program: U.S. Department of Health and Human Services, Assistance Listing #93.243 Substance Abuse and Mental Health Services Projects of Regional and National Significance. Criteria: 2 CFR section 200.302 establishes the requirements for sufficient financial management over grant funding to ensure records adequately identify the source and application of funds for federally funded activities. These records must contain information pertaining to Federal awards, authorizations, financial obligations, unobligated balances, assets, expenditures, income and interest and be supported by source documentation. Condition: We tested 32 payroll disbursements across five pay periods. Of those 32, 5 exceptions were noted. One exception was that the amount of time and corresponding amounts allocated to the grant did not agree to the percentage documented on the employee’s timesheet. For the other 4 exceptions, the supporting time sheets could not be provided for a pay period tested. Cause: Employee timesheets are turned in after payroll is processed and allocations made, the timesheet in this exception did not agree to the amount allocated. Four supporting time sheets for a January payroll processed could not be located. Effect: The Council did not retain proper documentation to support payroll costs charged to the grant. Questioned Costs: $729 Recommendation: We recommend the Council strengthen procedures surrounding payroll so that the source documentation agrees to and is retained to support the amounts being allocated to the grant based on actual employee time. Views of Responsible Officials: See Management’s View and Corrective Action Plan at the end of the report.
Finding 2024-005 Allowable Costs–Payroll Costs (Significant Deficiency and Noncompliance) (Repeat Finding) Information on the Federal Program: U.S. Department of Health and Human Services, Assistance Listing #93.243 Substance Abuse and Mental Health Services Projects of Regional and National Significance. Criteria: 2 CFR section 200.302 establishes the requirements for sufficient financial management over grant funding to ensure records adequately identify the source and application of funds for federally funded activities. These records must contain information pertaining to Federal awards, authorizations, financial obligations, unobligated balances, assets, expenditures, income and interest and be supported by source documentation. Condition: We tested 32 payroll disbursements across five pay periods. Of those 32, 5 exceptions were noted. One exception was that the amount of time and corresponding amounts allocated to the grant did not agree to the percentage documented on the employee’s timesheet. For the other 4 exceptions, the supporting time sheets could not be provided for a pay period tested. Cause: Employee timesheets are turned in after payroll is processed and allocations made, the timesheet in this exception did not agree to the amount allocated. Four supporting time sheets for a January payroll processed could not be located. Effect: The Council did not retain proper documentation to support payroll costs charged to the grant. Questioned Costs: $729 Recommendation: We recommend the Council strengthen procedures surrounding payroll so that the source documentation agrees to and is retained to support the amounts being allocated to the grant based on actual employee time. Views of Responsible Officials: See Management’s View and Corrective Action Plan at the end of the report.
Finding 2024-005 Allowable Costs–Payroll Costs (Significant Deficiency and Noncompliance) (Repeat Finding) Information on the Federal Program: U.S. Department of Health and Human Services, Assistance Listing #93.243 Substance Abuse and Mental Health Services Projects of Regional and National Significance. Criteria: 2 CFR section 200.302 establishes the requirements for sufficient financial management over grant funding to ensure records adequately identify the source and application of funds for federally funded activities. These records must contain information pertaining to Federal awards, authorizations, financial obligations, unobligated balances, assets, expenditures, income and interest and be supported by source documentation. Condition: We tested 32 payroll disbursements across five pay periods. Of those 32, 5 exceptions were noted. One exception was that the amount of time and corresponding amounts allocated to the grant did not agree to the percentage documented on the employee’s timesheet. For the other 4 exceptions, the supporting time sheets could not be provided for a pay period tested. Cause: Employee timesheets are turned in after payroll is processed and allocations made, the timesheet in this exception did not agree to the amount allocated. Four supporting time sheets for a January payroll processed could not be located. Effect: The Council did not retain proper documentation to support payroll costs charged to the grant. Questioned Costs: $729 Recommendation: We recommend the Council strengthen procedures surrounding payroll so that the source documentation agrees to and is retained to support the amounts being allocated to the grant based on actual employee time. Views of Responsible Officials: See Management’s View and Corrective Action Plan at the end of the report.
Finding 2024-006 – Activities Allowed (Significant Deficiency and Noncompliance)(Repeat Finding) Information on the Federal Program: U.S. Department of Veterans Affairs, Assistance Listing #64.055 Staff Sergeant Parker Gordon Fox Suicide Prevention Grant Program. Criteria: 2 CFR section 200.302 establishes the requirements for sufficient financial management over grant funding to ensure funds have been used in accordance with Federal statues, regulations, and terms and conditions of the Federal award. These requirements include that the nonfederal entity compare expenditures with the approved award budget. Condition: We tested 22 nonpayroll disbursements; one of those expenses did not fit into an expense category in the approved award budget. Cause: The Council began allocating non-reimbursable expenses to their grant codes to track the true costs of running a program. This grant allowed for indirect costs; however, these costs were charged directly to the grant and were included in the amount requested for reimbursement and also in the cost base used for the indirect cost calculation. These costs were not in line with the categories of expenses in the award budget. Effect: The Council allocated costs that were not allowable activities per the grant budget. Questioned Costs: $255 Recommendation: We recommend the Council strengthen procedures over costs invoiced for reimbursement to ensure those costs are compared to the grant budget for allowability. Views of Responsible Officials: See Management’s View and Corrective Action Plan at the end of the report.
Item 2024-001 Uniform Guidance Written Policies, Procedures and Standards of Conduct U.S. Department of Treasury COVID-19 Coronavirus State and Local Fiscal Recovery Funds Listing #21.027 Year Ended September 30, 2024 Criteria – Grantees should have written policies, procedures, and standards of conduct as required by 2 CFR 200, Subparts D & E of the Uniform Guidance. 2 CFR 200, Subparts D & E requires the non-Federal entity to establish and maintain written policies, procedures, and standards of conduct including internal controls over the Federal awards that provides reasonable assurance that the non‐Federal entity is managing the Federal statutes, regulations, and the terms and conditions of the Federal award. Specific requirements relate to the following: • § 200.302 Financial management • § 200.305 Payment Condition – The City does not have written policies, procedures and standards of conduct. Cause – The entity has failed to prepare written policies, procedures, and standards of conduct as required by 2 CFR 200, Subparts D & E of the Uniform Guidance. Questioned Costs – None noted Effect – Lack of written policies, procedures, and standards of conduct could result in noncompliance related to federal awards. Recommendation – We recommend that the Commission prepare written policies, procedures, and standards of conduct to include all the required elements as provided in 2 CFR 200, Subparts D & E of the Uniform Guidance. Management’s Response – The City is evaluating the auditor’s recommendations and will implement the necessary corrective action based on a cost benefit analysis.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.